apkscope
LOW
maintainer lapsus
0 votes
scanned 2026-11-05 00:08:17.114294
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=apkscope
3
pkgver=0.5.3
4
pkgrel=1
5
pkgdesc="Android APK decompiler, xrefs, API recon and MCP server, with native viewer"
6
arch=('x86_64')
7
url="https://github.com/suffixing/apkscope"
8
license=('Apache-2.0')
9
depends=(
10
'gcc-libs'
11
'glibc'
12
# Opened with dlopen by winit/glutin, so they appear in no NEEDED entry and
13
# namcap cannot see them, yet the viewer cannot create a window without them.
14
'libglvnd'
15
'libxkbcommon'
16
'libx11'
17
'wayland'
18
)
19
makedepends=('cargo')
20
# makepkg's `lto` option (on in stock Arch and here) injects -flto into CFLAGS,
21
# which turns the cc-built mimalloc and libdeflate sources into GCC LTO objects
22
# that rust-lld cannot link, failing on undefined mi_* and libdeflate_* symbols.
23
# Cargo.toml's own `lto = true` still applies to the Rust code.
24
options=('!lto')
25
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
26
sha256sums=('88c13c773fbec5467ee02432fa18c2e83abfc4dcf8c8c73e3cc6c35f7414d8da')
27
28
prepare() {
29
cd "$pkgname-$pkgver"
30
export RUSTUP_TOOLCHAIN=stable
31
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
32
}
33
34
build() {
35
cd "$pkgname-$pkgver"
36
export RUSTUP_TOOLCHAIN=stable
37
export CARGO_TARGET_DIR=target
38
# Upstream builds eframe with default-features off and never re-enables a
39
# windowing backend, so winit aborts with "The platform you're compiling for
40
# is not supported by winit" and the viewer only ever exists for Windows.
41
# Enabling the two backends winit needs makes the viewer build here.
42
cargo build --release --frozen --features eframe/x11,eframe/wayland
43
}
44
45
check() {
46
cd "$pkgname-$pkgver"
47
export RUSTUP_TOOLCHAIN=stable
48
export CARGO_TARGET_DIR=target
49
# Same feature set as build(): a --no-default-features test run would replace
50
# target/release/$pkgname with the viewer-less binary that package() installs.
51
cargo test --release --frozen --features eframe/x11,eframe/wayland
52
# The viewer is the only consumer of these strings; their presence is the
53
# proof that the tested binary is the one with the window, not the CLI build.
54
grep -qaF 'Drop an APK here' "target/release/$pkgname"
55
./target/release/apkscope --version
56
}
57
58
package() {
59
cd "$pkgname-$pkgver"
60
install -Dm755 "target/release/$pkgname" "$pkgdir/usr/bin/$pkgname"
61
# NOTICE carries terms the license text does not: the trademark restriction on
62
# the name and logo, and the AOSP provenance of src/data/android_public.txt.
63
install -Dm644 NOTICE -t "$pkgdir/usr/share/licenses/$pkgname/"
64
}
65
66
# Upstream tags releases without bumping the crate manifest (v0.5.3 still
67
# declares 0.5.2), so pkgver follows the release tag while `apkscope --version`
68
# reports the manifest number.
69
latestver() {
70
gh api repos/suffixing/apkscope/releases/latest --jq '.tag_name' |
71
sed -nE 's/^v([0-9]+(\.[0-9]+)*)$/\1/p'
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-05 00:08:17 | Low | 1 |